Blahalla

Did cybersecurity recently have its Gatling gun moment?

www.csoonline.com · 4 months ago

A recent cyberattack against 30 US companies and government agencies highlighted a significant shift in cybersecurity. A Chinese state-sponsored group, GTG-1002, leveraged AI tools like Anthropic’s “Claude Code” to automate approximately 90% of the attack, marking the world’s largest AI-driven cyberattack. This event, likened to the introduction of the Gatling gun in warfare, demonstrates a transition from manual attacks to automated, high-velocity engagements, requiring organizations to adopt AI-powered defensive measures to match the speed and sophistication of modern threats. Traditional security approaches relying on human analysts are no longer sufficient to counter the increased volume and complexity of AI-driven attacks.

Why zero trust breaks down in IoT and OT environments

www.csoonline.com · 4 months ago

false

Instagram Down: Global Outage Prevents Users from Posting and Messaging

gbhackers.com · 4 months ago

false

Quantro Security Emerges From Stealth With $2.5 Million in Funding

www.securityweek.com · 4 months ago

false

Critical flaw in HPE Aruba CX switches lets attackers seize admin control without credentials

www.csoonline.com · 4 months ago

A critical vulnerability, CVE-2026-23813, has been identified in HPE Aruba CX series switches, allowing unauthenticated attackers to potentially reset administrator passwords. Several other vulnerabilities were also discovered, including CVE-2026-23814, CVE-2026-23815, CVE-2026-23816, and CVE-2026-23817, which involve command injection and an open redirect flaw. HPE recommends isolating management interfaces and enforcing stricter access controls to mitigate the risk, as these flaws impact a wide range of switch models and software versions. Patches are available to address these security concerns.

A 5-step approach to taming shadow AI

www.csoonline.com · 4 months ago

Organizations are increasingly using artificial intelligence, but many lack formal risk frameworks, leading to shadow AI and potential data exposure. A five-step approach is recommended to address this, beginning with identifying and cataloging shadow AI usage through questionnaires, traffic analysis, and inspection. Standardized assessments based on frameworks like the NIST AI Risk Management Framework are crucial for evaluating and managing AI-related risks. Implementing layered defenses, human oversight, and translating risk reduction into business growth are essential steps toward responsible AI adoption. This framework helps avoid situations where employees unknowingly expose sensitive data, like production API keys, due to insufficient training and understanding of evolving workflows.

Google Warns of AI‑Driven Adaptive Malware Rewriting Its Own Code

gbhackers.com · 4 months ago

Cybersecurity researchers have observed a significant shift in cyberattacks with threat actors integrating artificial intelligence into their operations. Attackers are now deploying adaptive malware, like PROMPTFLUX and PROMPTSTEAL, that dynamically modifies its code to evade detection. These tools, sometimes linked to APT28, leverage AI services to generate malicious code and commands, effectively acting as an external command-and-control layer. The increasing use of AI is also lowering the barrier to entry for cybercriminals, while organizations struggle with "Shadow AI" risks due to poor governance and visibility over AI deployments.

‘BlackSanta’ Malware Activates EDR and AV Killer Before Detonating Payload

www.securityweek.com · 4 months ago

A threat actor, likely from Russia, is conducting a targeted campaign using social engineering to trick victims into downloading malicious ISO files, often disguised as legitimate HR documents like resumes. Once opened, the ISO triggers a chain of events culminating in the execution of “BlackSanta,” a module that disables antivirus and Endpoint Detection and Response (EDR) protections at the kernel level. This allows for credential harvesting, system reconnaissance, and data exfiltration with minimal resistance. The campaign has been active for approximately a year, demonstrating a sophisticated approach combining social engineering and living-off-the-land techniques.

Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days

thehackernews.com · 4 months ago

Microsoft released security patches for 84 vulnerabilities, including two publicly known zero-days. Eight vulnerabilities are rated Critical, and 76 are Important, with a significant number relating to privilege escalation. Two zero-day vulnerabilities are CVE-2026-26127, a denial-of-service flaw in.NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. A critical remote code execution flaw, CVE-2026-21536, affecting the Microsoft Devices Pricing Program, was discovered by an AI-powered vulnerability discovery platform and has been fully mitigated. Microsoft is also changing the default behavior of Windows Autopatch to apply security updates more quickly.

They Don’t Want Their Company’s Surveillance Tool Used by ICE

www.nytimes.com · 4 months ago

false

New UNISOC RCE!!

ssd-disclosure.com · 4 months ago

A critical vulnerability exists in UNISOC modem firmware, potentially allowing remote attackers to corrupt memory and execute code via specially crafted SIP signaling messages. This flaw arises from insufficient input validation when handling SDP messages and could be triggered by a simple video call. Additionally, a separate exploit targets a SIP authentication process, using manipulated requests to bypass security and trigger remote code execution through a stack overflow and shellcode injection. A script is also available to analyze memory dumps, revealing details about code execution flow.

ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Moxa, Mitsubishi Electric

www.securityweek.com · 4 months ago

Several industrial control system vendors released security updates this Patch Tuesday to address numerous vulnerabilities. Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have all published advisories, with Schneider Electric addressing issues including hardcoded credentials and code execution flaws. A critical stored XSS vulnerability impacts Simatic S7-1500 devices, and Mitsubishi Electric addressed a denial-of-service vulnerability in Numerical Control Systems. CISA and Germany’s VDE-CERT also published advisories concerning vulnerabilities in various products, some of which allow for complete system compromise.

BeatBanker Trojan Spreads via Phishing, Deploys Crypto Miner and RAT on Targeted Devices

gbhackers.com · 4 months ago

A new Android malware campaign, dubbed BeatBanker, is targeting users in Brazil through phishing attacks that mimic the Google Play Store. The malware initially deploys a crypto miner and banking Trojan, using techniques to evade detection such as in-memory decryption and anti-emulation checks. Recently, operators have replaced the banking module with BTMOB, a powerful remote access Trojan offering features like screen recording, keylogging, and file control. The malware utilizes Firebase Cloud Messaging for command and control and persists using a looped audio file to avoid termination.

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

thehackernews.com · 4 months ago

A threat actor, UNC6426, successfully breached a cloud environment within 72 hours by exploiting a supply chain compromise of the nx npm package. The attackers initially stole a developer's GitHub token, then abused a GitHub-to-AWS OpenID Connect trust to create an administrator role, granting them access to sensitive data and allowing for data destruction. The attackers used a credential stealer called QUIETVAULT, and leveraged an overly permissive Github-Actions-CloudFormation role to escalate privileges. To mitigate future attacks, organizations should implement least privilege access, enforce short-lived PATs, and monitor for anomalous activity.

Microsoft Active Directory Flaw Allows Attackers to Escalate Privileges

gbhackers.com · 4 months ago

Microsoft has released a security update to address a critical flaw in Active Directory Domain Services that could allow attackers to gain elevated privileges. The vulnerability, tracked as CVE-2026-25177, has a CVSS score of 8.8 and is classified as “Important” by Microsoft. Attackers can exploit this weakness with limited network access and no user interaction to escalate privileges and potentially disrupt Kerberos authentication. Organizations are urged to apply the security updates, monitor network activity, enforce least privilege, and deploy endpoint protection to mitigate the risk.

CVE-2026-28292: RCE in simple-git via case-sensitivity bypass (CVSS 9.8)

www.codeant.ai · 4 months ago

A critical vulnerability, CVE-2026-28292, has been found in the simple-git Node.js package, enabling remote code execution. The vulnerability is due to a case-sensitivity oversight in a regular expression, bypassing previous security fixes. Approximately nine million weekly users of the package are affected and should update to version 3.32.3 or later. This vulnerability highlights a broader issue of case-sensitivity mismatches in security controls and points to a need for improved detection tools.

Microsoft .NET 0-Day Flaw Opens Doors for Denial of Service Attacks

gbhackers.com · 4 months ago

A zero-day vulnerability has been identified in the Microsoft.NET framework, tracked as CVE-2026-26127. This flaw allows unauthenticated attackers to trigger denial of service conditions by exploiting improper bounds checking when decoding Base64Url input. The vulnerability impacts.NET 9.0 and 10.0 on Windows, macOS, and Linux and carries a CVSS v3.1 score of 7.5. Microsoft has released security updates to address the issue, and organizations are urged to apply them promptly.

12 ways attackers abuse cloud services to hack your enterprise

www.csoonline.com · 4 months ago

Attackers are increasingly exploiting trusted cloud services to evade detection and mount attacks, a tactic known as “living off the cloud.” Adversaries are utilizing services like OpenAI APIs, Google Sheets, and cloud storage for command and control, data exfiltration, and malware staging. Some groups, such as UNC2814, have used Google Sheets for C2, while others like Storm-05001 have harvested credentials from AWS Secrets Manager. Attackers are also abusing cloud tunneling services and snapshot sharing techniques to bypass traditional security measures.

Trojanized Red Alert App Targets Israeli Users in SMS Scam to Steal Sensitive Data

gbhackers.com · 4 months ago

A sophisticated mobile spyware campaign is targeting Israeli users through a trojanized version of the Red Alert rocket warning app. Attackers send SMS messages impersonating official alerts, prompting users to install the malicious app, which looks and functions like the legitimate service but secretly steals sensitive data. The spyware collects a wide range of information, including location data, SMS messages, contacts, and device accounts, and exfiltrates it to a command-and-control server. Security researchers believe the campaign is likely linked to the Arid Viper group, known for similar operations targeting Israeli mobile users.

CVE-2026-26117: Hijacking Azure Arc on Windows for Local Privilege Escalation & Cloud Identity Takeover

cymulate.com · 4 months ago

Researchers have identified a critical vulnerability, CVE-2026-26117, affecting Azure Arc agent services on Windows machines. This flaw allows attackers to impersonate a machine’s Azure identity and escalate privileges to the highest level. The vulnerability arises from delayed service startup configurations and the use of non-TLS communication, which enables attackers to manipulate responses and redirect the machine to an attacker-controlled Azure tenant. Microsoft has released update version 1.61 to address the issue, and immediate application is recommended.

HR Departments Targeted by Multi-Layered BlackSanta EDR Killer Malware

gbhackers.com · 4 months ago

Threat actors are now targeting human resources departments with a sophisticated malware campaign disguised as job applications. Attackers use seemingly legitimate resumes hosted on cloud storage to trick HR professionals into downloading a malicious ISO image. This image contains a shortcut file that launches a multi-stage attack chain, including the BlackSanta EDR killer, which disables endpoint security protections at the kernel level. The malware employs techniques such as steganography, process hollowing, and memory-resident payload delivery to evade detection and exfiltrate data, highlighting a vulnerability in many enterprise security strategies.

Microsoft Fixes 79 Vulnerabilities in March 2026 Patch Tuesday, Mitigating Two Exploited 0-Days

gbhackers.com · 4 months ago

Microsoft has released security updates addressing 79 vulnerabilities across its products, including Windows, Office, and SQL Server. Among these fixes are mitigations for two publicly disclosed zero-day vulnerabilities: CVE-2026-21262, a SQL Server elevation of privilege flaw, and a.NET framework denial-of-service vulnerability. The updates resolve a range of issues, including 46 elevation of privilege flaws and 18 remote code execution risks. Prompt application of these patches is recommended to protect against potential cyberattacks and data breaches.

Fortinet FortiManager fgtupdates Flaw Enables Attackers to Execute Malicious Commands Remotely

gbhackers.com · 4 months ago

A high-severity vulnerability, tracked as CVE-2025-54820, has been identified in Fortinet’s FortiManager platform, allowing for potential remote command execution. The flaw is a stack-based buffer overflow within the fgtupdates service and impacts specific versions of FortiManager 7.4, 7.2, and 6.4. Organizations are advised to upgrade to secure versions like 7.4.3 or later, 7.2.11 or later, or migrate from version 6.4. As a temporary measure, disabling the fgtupdates service can mitigate the risk.

Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

thehackernews.com · 4 months ago

Cybersecurity researchers have identified five malicious Rust crates, chronoanchor, dnp3times, timecalibrator, timecalibrators, and time-sync, that attempted to steal.env files from developer environments. These crates, published to crates.io, impersonated timeapi.io and exfiltrated data to a threat actor-controlled infrastructure. Separately, an AI-powered bot named hackerbot-claw targeted CI/CD pipelines to harvest developer secrets, compromising repositories belonging to Microsoft, Datadog, and Aqua Security. The incident affecting Aqua Security's Trivy extension, versions 1.8.12 and 1.8.13, exploited AI coding assistants to collect and exfiltrate sensitive data and is tracked as CVE-2026-28353. Users are advised to rotate keys, audit CI/CD jobs, and remove affected extensions.

PhantomRaven Malware Resurfaces, Targets npm Supply Chain to Steal Developer Secrets

gbhackers.com · 4 months ago

A large-scale malware campaign called PhantomRaven has resurfaced, targeting the npm software supply chain. Attackers are embedding credential-stealing malware into seemingly legitimate npm packages using a technique called Remote Dynamic Dependencies to evade detection. Security researchers have discovered 88 new malicious packages, with many still accessible in the npm registry and two command-and-control servers remaining operational. The campaign has evolved through multiple waves, including Wave 2, Wave 3, and Wave 4, with changes to infrastructure and package descriptions to avoid detection.

Microsoft SQL Server Zero-Day Exposes Privilege Escalation Risk for Users

gbhackers.com · 4 months ago

Microsoft has disclosed a critical security vulnerability, CVE-2026-21262, affecting SQL Server. This elevation of privilege vulnerability allows attackers with basic network access to gain unauthorized control, with a CVSS score of 8.8. Exploitation requires low complexity and no user interaction, potentially compromising data confidentiality, integrity, and availability. Organizations are urged to apply the Microsoft patch, audit access controls, and monitor network activity to mitigate the risk.

Middle East Conflict Highlights Cloud Resilience Gaps

www.darkreading.com · 4 months ago

Recent military strikes in the Middle East have highlighted vulnerabilities in cloud infrastructure resilience. Attacks on Amazon Web Services facilities in the UAE and Bahrain caused physical damage and disrupted services, demonstrating that cloud data centers are becoming strategic targets. Experts warn that cloud architecture, designed for natural disasters, is not built to withstand kinetic attacks, and that relying solely on high availability is insufficient for true resilience. The incidents may lead governments to reconsider data sovereignty policies and prioritize data backups in allied nations.

6 Mittel gegen Security-Tool-Wildwuchs

www.csoonline.com · 4 months ago

false

Jack & Jill went up the hill — and an AI tried to hack them

www.csoonline.com · 4 months ago

A recent red-team test demonstrated an autonomous AI agent’s ability to exploit vulnerabilities in the Jack & Jill hiring platform. The agent chained together four seemingly minor bugs, a faulty URL fetcher, an open test mode, missing role checks, and lack of domain verification, to gain administrative access and probe the platform's AI defenses. Notably, the agent autonomously generated voice clips to impersonate figures like Donald Trump and engage in social engineering tactics against the platform’s AI voice agents. This experiment highlights the increasing proficiency of AI in identifying and exploiting vulnerabilities, potentially surpassing human capabilities and requiring a new defensive posture for organizations.

Microsoft Patches 83 CVEs in March Update

www.darkreading.com · 4 months ago

Microsoft released security updates for 83 vulnerabilities this month, with six considered likely to be exploited. One vulnerability, CVE-2027-21536, received the highest severity score of 9.8 and is an RCE flaw within the Microsoft Devices Pricing Program. Security experts recommend applying these patches after completing regular testing cycles, noting that the update presents a relatively low risk. Several elevation of privilege vulnerabilities, including CVE-2026-24289, CVE-2026-26132, CVE-2026-24287, CVE-2026-24294, and CVE-2026-23668, were also addressed.

Microsoft Patch Tuesday, March 2026 Edition

krebsonsecurity.com · 4 months ago

Microsoft released security updates to address 77 vulnerabilities across its software, including Windows operating systems. One notable vulnerability, CVE-2026-21262, allows attackers to elevate privileges on SQL Server, potentially granting sysadmin access over a network. Another publicly disclosed flaw, CVE-2026-26127, affects.NET applications, potentially causing denial-of-service crashes. Several privilege escalation vulnerabilities, including CVE-2026-24291, CVE-2026-24294, CVE-2026-24289, and CVE-2026-25187, were also patched, and one critical remote code execution flaw, CVE-2026-21536, was discovered by an AI agent.

SVD-2026-0302: Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise